Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30/10/2024, 23:54
General
-
Target
80b102573a985be37f1eadbbb7ab94a8_JaffaCakes118.exe
-
Size
712KB
-
MD5
80b102573a985be37f1eadbbb7ab94a8
-
SHA1
ee8d67dcbe0bfb840b743f2b995438d6a89eb17d
-
SHA256
61b0875321fd4ee0cfc5096691dfa3ffeec7f4f893d1a712dc50b736cc7dc38a
-
SHA512
61bc870e0ca64bb88e34380f8f176f4716ab3fd481bfcaa55f7eefc0957ae2b3f1ef9ba4107a905e22c995e8af127efbded80fd7bcd5a876cec6ca783b72dc3f
-
SSDEEP
12288:UaAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuNKp:lAEE3uBDhynCylQgi63O9+VuNQ
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Modifies security service 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Windows security modification 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80b102573a985be37f1eadbbb7ab94a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\80b102573a985be37f1eadbbb7ab94a8_JaffaCakes118.exe"1⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB